|  | 6.3 | Standard ACLs
| 6.3.5 | Writing a standard ACL to deny a specific host

The example below shows how an ACL is designed to block traffic from a specific address, 172.16.4.13, and to allow all other traffic to be forwarded on interface Ethernet 0. The first access-list command uses the deny parameter to deny traffic from the identified host. The address mask 0.0.0.0 in this line requires the test to match all bits. In the second access-list command, the 0.0.0.0 255.255.255.255 IP address/ wildcard mask combination identifies traffic from any source. This combination can also be written using the keyword any. All zeros in the address indicate a placeholder, and all ones in the wildcard mask indicate that all 32 bits will not be checked in the source address. Any packet that does not match the first line of the ACL will match the second one and be forwarded. Denying a Specific Host access-list 1 deny host 172.16.4.13 0.0.0.0 access-list 1 permit 0.0.0.0 255.255.255.255 (implicit deny any) (access-list 1 deny 0.0.0.0 255.255.255.255) interface ethernet 0 ip access-group 1 out